CVEvulnerability

CVE-2026-104892

8.7 HIGH Published 2026-10-05 Modified 2026-10-05 Official page ↗

Status: Deferred
Published: 2026-10-05
Last modified: 2026-10-05
Assigner: [email protected]
CVSS 4.0 ([email protected]): 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses: CWE-256

Description

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0.

Weakness · CWE (1)

CWE-256 Plaintext Storage of a Password weakness

References

https://github.com/makeplane/plane/commit/edf247541301e482f2688c63481464b671ec579d github.com
https://github.com/makeplane/plane/pull/9148 github.com
https://github.com/makeplane/plane/releases/tag/v1.4.0 github.com
https://github.com/makeplane/plane/security/advisories/GHSA-r5p8-cj3q-38cc github.com

CVE-2026-104892

Description

Related

Weakness · CWE (1)

References